This Privacy Policy explains how rothysy.shop (“rothysy.shop”, “we”, “us”, or “our”) collects, uses, discloses, stores, and protects personal information when you:

• Visit or browse rothysy.shop

• Create or use a customer account

• Add products to your basket

• Place or manage an order

• Submit or receive a payment

• Request delivery, cancellation, return, exchange, or refund support

• Subscribe to marketing communications

• Contact customer service

• Submit a review, photograph, video, or other content

• Exercise a data-protection right

• Make a complaint

• Otherwise interact with our website and related services

The website, online store, customer-account features, checkout facilities, communications, and related services are collectively referred to as the “Services”.

Please read this Privacy Policy carefully. It should be read together with our Terms of Service, Return and Refund Policy, Shipping Policy, Legal Notice, Cookie settings, and any additional notice displayed when personal information is collected.

1. Data Controller

For the purposes of applicable UK data-protection law, the operator of rothysy.shop determines how and why personal information collected through the Services is processed.

Website: rothysy.shop
Privacy and Customer-Service Email: info@rothysy.shop

Questions, requests, objections, withdrawals of consent, or complaints concerning personal information may be submitted using the email address above.

2. Meaning of Personal Information

“Personal information” and “personal data” mean information relating to an identified or identifiable individual.

Personal information does not ordinarily include information that has been irreversibly anonymised so that an individual can no longer reasonably be identified.

The personal information we collect depends on how you interact with the Services.

3. Information You Provide Directly

We may collect information that you provide directly, including:

• Full name

• Email address

• Telephone number

• Billing address

• Delivery address

• Customer-account information

• Account login and authentication information

• Order number

• Products ordered

• Product size, colour, style, or other selections

• Basket and saved-product information

• Payment and transaction information

• Delivery instructions

• Cancellation information

• Return, exchange, and refund information

• Marketing preferences

• Customer-service communications

• Complaints and dispute information

• Reviews, ratings, photographs, videos, and feedback

• Information submitted with a data-protection request

• Information submitted with an intellectual-property complaint

• Any other information you choose to provide

You are responsible for ensuring that information provided to us is accurate, complete, and current.

4. Information About Other People

You may provide information relating to another person, such as:

• A delivery recipient

• A gift recipient

• An authorised representative

• A person collecting an order

• A person assisting with a complaint or privacy request

You should provide another person’s information only where you have a lawful reason and appropriate authority to do so.

Where appropriate, you should inform that person that their information has been provided to rothysy.shop and direct them to this Privacy Policy.

5. Payment Information

Payments made through rothysy.shop are processed through Shopify and authorised third-party payment providers.

Payment-related information may include:

• Name of the cardholder or account holder

• Billing address

• Selected payment method

• Transaction amount

• Payment status

• Payment authorisation information

• Limited card information

• Fraud-prevention information

• Refund information

• Chargeback and payment-dispute information

rothysy.shop does not generally receive or store complete payment-card numbers or payment-card security codes.

Payment providers process payment information under their own legal obligations and privacy notices.

6. Information Collected Automatically

When you access or use the Services, we, Shopify, and our service providers may automatically collect information such as:

• Internet Protocol address

• Browser type and version

• Device type

• Operating system

• Device and advertising identifiers

• Language and regional settings

• Approximate location derived from an Internet Protocol address

• Referring website, advertisement, search engine, or source

• Pages and products viewed

• Search terms entered

• Links and buttons selected

• Basket and checkout activity

• Customer-account activity

• Date and time of access

• Session duration

• Website navigation

• Marketing-email engagement

• Cookie and similar identifiers

• Website-performance information

• Error and diagnostic information

• Security and fraud-detection information

This information may be collected through cookies, pixels, tags, scripts, local storage, server logs, software development kits, and similar technologies.

7. Information Received from Other Sources

We may receive personal information from third parties, including:

• Shopify

• Payment processors

• Banks and payment networks

• Digital-wallet providers

• Fraud-prevention and identity-verification services

• Shipping carriers

• Warehouses and fulfilment providers

• Address-verification services

• Customer-support providers

• Analytics providers

• Advertising and marketing partners

• Social-media platforms

• Applications connected to our Shopify store

• Website-security providers

• Information-technology providers

• Parties authorised by you

• Public authorities where legally permitted

We process information received from third parties in accordance with this Privacy Policy and any applicable restrictions imposed by the source.

8. How We Use Personal Information

We may process personal information for the purposes described below.

Providing Products and Services

We may use personal information to:

• Receive and process orders

• Verify order details

• Authorise and process payments

• Confirm purchases

• Maintain customer accounts

• Prepare and fulfil orders

• Arrange shipping and delivery

• Provide tracking information

• Process cancellations

• Process returns and exchanges

• Issue refunds

• Respond to customer enquiries

• Provide requested products and Services

• Send transaction-related communications

Operating and Improving the Website

We may use personal information to:

• Operate and maintain rothysy.shop

• Remember basket contents and preferences

• Provide customer-account functionality

• Improve website navigation

• Diagnose technical problems

• Analyse website performance

• Understand how visitors use the Services

• Improve product information

• Develop or test website features

• Measure customer satisfaction

• Improve customer support

Security and Fraud Prevention

We may use personal information to:

• Verify customer and payment information

• Detect suspicious transactions

• Prevent payment fraud

• Protect customer accounts

• Detect false delivery or return claims

• Investigate chargebacks

• Prevent promotion abuse

• Maintain website security

• Enforce our policies

• Protect customers, service providers, and our business

Marketing and Personalisation

Subject to applicable law and your preferences, we may use personal information to:

• Send marketing emails

• Recommend products

• Personalise website content

• Measure marketing effectiveness

• Understand advertising interactions

• Create advertising audiences

• Display relevant advertising

• Limit repetitive advertising

• Analyse interest in products and promotions

Legal and Administrative Purposes

We may use personal information to:

• Comply with legal and regulatory obligations

• Maintain transaction, tax, and accounting records

• Respond to lawful requests

• Establish, exercise, or defend legal claims

• Investigate suspected unlawful conduct

• Enforce contracts and policies

• Resolve disputes and complaints

• Protect legal rights, property, safety, and security

• Respond to product-safety or recall matters

9. Lawful Bases for Processing

We process personal information only where an applicable lawful basis is available.

The lawful basis depends on the information, purpose, and circumstances.

Performance of a Contract

We may process personal information where necessary to enter into or perform a contract with you, including to:

• Process an order

• Receive payment

• Deliver a product

• Maintain a customer account

• Process a cancellation

• Manage a return or exchange

• Issue a refund

• Provide requested customer support

Failure to provide information necessary for a contract may prevent us from completing an order or providing the requested Services.

Legal Obligation

We may process personal information where necessary to comply with legal obligations relating to:

• Taxation

• Accounting

• Consumer protection

• Product safety

• Fraud prevention

• Data-protection rights

• Regulatory enquiries

• Legal claims

• Court orders

• Lawful government requests

Legitimate Interests

We may process personal information where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights and freedoms.

These interests may include:

• Operating and improving the online store

• Providing effective customer support

• Protecting the Services

• Preventing fraud and misuse

• Maintaining transaction and business records

• Understanding website use

• Improving products and Services

• Establishing or defending legal claims

• Sending legally permitted marketing for similar products

• Protecting customers and service providers

Where we rely on legitimate interests, we consider the purpose, necessity, reasonable expectations, potential effect on individuals, and available safeguards.

Consent

We may rely on consent for activities such as:

• Using optional cookies or tracking technologies

• Sending certain marketing communications

• Processing information for another purpose clearly explained when consent is requested

You may withdraw consent at any time.

Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

Vital Interests

In exceptional circumstances, we may process personal information where necessary to protect someone’s life or physical safety.

10. Cookies and Similar Technologies

We, Shopify, and our service providers may use cookies and similar technologies to operate, secure, analyse, and personalise the Services.

These technologies may include:

• Cookies

• Tracking pixels

• Web beacons

• Tags

• Scripts

• Local storage

• Device identifiers

• Link-decoration technologies

• Other storage or access technologies

Some technologies operate only during a browser session. Others may remain on a device for a defined period.

11. Strictly Necessary Technologies

Strictly necessary technologies support Services requested by the user and may be used to:

• Maintain basket contents

• Operate checkout

• Process payments

• Authenticate customer accounts

• Maintain website security

• Detect fraud

• Remember privacy choices

• Manage network traffic

• Provide requested website functionality

Where legally permitted, these technologies may operate without consent because the requested service cannot function properly without them.

Blocking them may prevent basket, checkout, payment, account, or security features from working correctly.

12. Analytics and Performance Technologies

Analytics and performance technologies may help us understand:

• How many visitors use the website

• Which pages and products are viewed

• How visitors navigate the Services

• Whether errors occur

• How quickly pages load

• Which sources lead visitors to the website

• How the website can be improved

Where consent is required, these technologies will not be activated until valid consent has been provided.

Certain limited technologies may be used without consent only where a specific legal exception applies and all applicable transparency, purpose, minimisation, and objection requirements are satisfied.

13. Advertising Technologies

Advertising technologies may be used to:

• Present advertisements

• Personalise marketing

• Create advertising audiences

• Measure advertising effectiveness

• Understand whether advertisements lead to visits or purchases

• Limit repeated advertisements

• Analyse campaign performance

Advertising technologies are not treated as strictly necessary.

Where required by applicable law, we will request consent before activating advertising-related technologies or accessing information stored on your device.

14. Managing Cookie Preferences

You may manage applicable technologies through:

• The cookie banner displayed on rothysy.shop

• A cookie-preference centre made available through the website

• Your browser settings

• Your device settings

• Available platform or advertising controls

You may withdraw consent for optional technologies at any time by changing your preferences.

Withdrawing consent does not affect processing that occurred before the preference was changed.

Deleting cookies may also delete saved privacy choices, meaning you may need to select them again.

Browser controls may not prevent every form of tracking technology.

15. Shopify’s Role

rothysy.shop uses Shopify’s ecommerce platform to host and operate the online store.

Shopify may process personal information to provide services including:

• Website hosting

• Checkout

• Payment processing

• Customer accounts

• Order management

• Store security

• Fraud prevention

• Analytics

• Personalisation

• Platform development

• Other ecommerce functionality

Shopify may process information as a service provider acting on our instructions and, in certain circumstances, for its own purposes under its applicable privacy documentation.

Information processed through Shopify may be stored or processed outside the United Kingdom.

16. Shopify Network Intelligence

If Shopify Network Intelligence or related enhanced services are enabled for rothysy.shop, Shopify may process information from interactions with our store together with information from interactions with Shopify or other participating Shopify merchants.

This may support:

• Fraud prevention

• Product discovery

• Ecommerce personalisation

• Advertising measurement

• Analytics

• Checkout improvement

• Platform security

• Development of Shopify services

Such processing is subject to applicable privacy settings, legal requirements, available consent choices, and Shopify’s own privacy documentation.

17. Disclosure of Personal Information

We may disclose personal information where reasonably necessary for the purposes described in this Privacy Policy.

Shopify and Ecommerce Providers

We may disclose information to Shopify and providers supporting:

• Website hosting

• Checkout

• Customer accounts

• Store security

• Ecommerce operations

• Technical support

Payment and Financial Providers

We may disclose information to:

• Payment processors

• Banks

• Card networks

• Digital-wallet providers

• Fraud-prevention providers

• Transaction-verification services

These providers may use information to authorise, process, secure, refund, and document payments.

Fulfilment and Delivery Providers

We may disclose information to:

• Warehouses

• Suppliers

• Fulfilment providers

• Shipping carriers

• Courier services

• Customs brokers

• Delivery partners

• Address-verification services

These providers may use information to prepare, transport, track, clear, and deliver orders.

Technology and Professional Providers

We may disclose information to providers supporting:

• Website hosting

• Cloud storage

• Information technology

• Cybersecurity

• Customer service

• Email communications

• Data analytics

• Fraud detection

• Accounting

• Legal advice

• Regulatory compliance

• Business administration

Marketing and Advertising Providers

Subject to applicable consent and legal requirements, we may disclose relevant identifiers, device information, website activity, or purchase information to:

• Analytics providers

• Advertising networks

• Social-media platforms

• Search engines

• Marketing-service providers

These providers may assist with advertising delivery, measurement, audience creation, personalisation, and campaign analysis.

Legal and Safety Disclosures

We may disclose personal information where reasonably necessary to:

• Comply with applicable law

• Respond to lawful legal process

• Cooperate with regulators or public authorities

• Detect or investigate fraud

• Protect customers and the public

• Protect legal rights, property, and security

• Enforce our agreements and policies

Business Transactions

Personal information may be disclosed or transferred in connection with:

• A merger

• Acquisition

• Financing

• Reorganisation

• Insolvency

• Sale of assets

• Transfer of business operations

• Similar lawful business transaction

Any transfer will be handled subject to applicable data-protection law.

At Your Direction

We may disclose personal information to another party where you request, authorise, or consent to the disclosure.

18. International Transfers

We, Shopify, and our service providers may process personal information outside the United Kingdom.

Countries outside the United Kingdom may have data-protection laws that differ from UK law.

Where a restricted international transfer occurs, we will take reasonable steps to ensure that an appropriate legal mechanism or exception applies.

Safeguards may include:

• UK adequacy regulations

• The UK International Data Transfer Agreement

• The UK Addendum to approved standard contractual clauses

• Contractual, organisational, and technical safeguards

• Another legally recognised transfer mechanism

• A legally permitted exception in limited circumstances

Where required, a transfer-risk assessment or other legally required assessment may be completed.

You may contact info@rothysy.shop for further information about safeguards relevant to your personal information.

19. Direct Marketing

We may send marketing communications where:

• You have provided valid consent;

• The communication is otherwise permitted by electronic-marketing law; or

• Another applicable legal condition has been satisfied.

Where the customer soft opt-in is used, marketing will be limited to our own similar products or Services.

A clear opportunity to opt out will be provided when contact details are collected and in each subsequent marketing communication.

We will not use the customer soft opt-in for unrelated third-party products or for individuals who do not satisfy the applicable legal conditions.

20. Withdrawing from Marketing

You may stop promotional emails by:

• Selecting the unsubscribe link included in the message

• Contacting info@rothysy.shop

After unsubscribing, you may continue to receive non-promotional communications concerning:

• Orders

• Payments

• Shipping

• Delivery

• Returns

• Exchanges

• Refunds

• Customer service

• Account security

• Product safety

• Legal notices

• Policy changes

We may retain limited suppression information to ensure that your marketing preference continues to be respected.

Withdrawing from email marketing does not automatically change your cookie preferences. Cookie choices should be managed separately.

21. Data Retention

We retain personal information only for as long as reasonably necessary for the relevant purpose.

Retention periods are determined by considering:

• The nature and sensitivity of the information

• The purpose for which it was collected

• The status of the customer relationship

• Contractual requirements

• Tax and accounting obligations

• Consumer-protection requirements

• Product-safety obligations

• Fraud-prevention needs

• Security requirements

• Applicable limitation periods

• Regulatory requirements

• Technical backup and deletion processes

Order, payment, delivery, return, refund, and transaction records may be retained for the period reasonably required to satisfy accounting, tax, consumer, fraud-prevention, and legal obligations.

Customer-service records may be retained for as long as reasonably necessary to resolve the enquiry, document the outcome, and manage related claims.

Marketing information may be retained until you withdraw consent, object, or the information is no longer required, subject to limited suppression records.

When information is no longer required, we may securely delete, anonymise, aggregate, or otherwise dispose of it.

22. Data Security

We use reasonable technical and organisational measures designed to protect personal information against:

• Unauthorised access

• Accidental loss

• Misuse

• Alteration

• Unauthorised disclosure

• Destruction

Measures may include:

• Access restrictions

• Secure payment processing

• Encryption during transmission

• Account authentication

• Fraud monitoring

• Security testing

• Confidentiality controls

• Service-provider safeguards

• Incident-response procedures

No website, internet transmission, or electronic storage system is completely secure.

We cannot guarantee absolute security, but we take reasonable steps to protect personal information.

You are responsible for protecting account credentials and notifying us promptly if you suspect unauthorised access.

23. Personal-Data Breaches

If we become aware of a personal-data breach, we may:

• Investigate the incident

• Take steps to contain and remedy it

• Work with Shopify and relevant service providers

• Preserve relevant evidence

• Assess possible risks

• Notify the Information Commissioner’s Office

• Notify affected individuals

Notifications will be made where and within the period required by applicable law.

24. Your Data-Protection Rights

Subject to applicable law and relevant exceptions, you may have the rights described below.

Right to Be Informed

You have the right to receive clear information about how your personal information is collected and used.

Right of Access

You may request confirmation of whether we process your personal information and request a copy of relevant information.

Right to Rectification

You may request correction of inaccurate personal information and completion of incomplete information.

Right to Erasure

You may request deletion of personal information in circumstances where the right applies.

This right is not absolute. Information may be retained where processing remains necessary for legal obligations, fraud prevention, contractual matters, legal claims, or another lawful purpose.

Right to Restrict Processing

You may request restriction of processing in certain circumstances.

Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive relevant information in a structured, commonly used, machine-readable format.

Right to Object

You may object to processing based on legitimate interests in certain circumstances.

You have the right to object at any time to processing for direct-marketing purposes.

When a valid direct-marketing objection is received, we will stop using the relevant information for that purpose.

Rights Relating to Automated Decisions

You may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Right to Complain

You may complain to us and may also complain to the Information Commissioner’s Office.

25. Exercising Your Rights

To exercise a data-protection right, contact:

Email: info@rothysy.shop

Please include:

• Your full name

• The email address associated with your account or order

• Your order number where relevant

• The right you wish to exercise

• A clear description of the information or processing involved

You are not normally required to pay a fee.

A reasonable fee may be charged, or a request may be refused, only where permitted by applicable law, such as where a request is manifestly unfounded or excessive.

26. Identity Verification

Before responding to certain requests, we may need to verify your identity.

Verification may involve confirming:

• Your email address

• Order information

• Billing or delivery information

• Customer-account information

• Other information reasonably necessary to prevent unauthorised disclosure

We will request only information reasonably necessary for verification.

If we cannot reasonably verify your identity or authority, we may be unable to complete the request.

27. Authorised Representatives

You may authorise another person to act on your behalf where permitted by law.

We may request:

• Evidence of the representative’s authority

• Verification of your identity

• Confirmation that you authorised the request

We may communicate directly with you where reasonably necessary to protect your information.

28. Response to Rights Requests

We will respond to valid data-protection requests within the period required by applicable law.

The response period may be extended where legally permitted because of the complexity or number of requests.

Where an extension applies, we will notify you and explain the reason.

We may request reasonable clarification where necessary to identify the information or processing covered by a request.

29. Data-Protection Complaints

You may complain about how we collect, use, disclose, retain, or protect personal information by contacting:

Email: info@rothysy.shop

Your complaint should include:

• Your full name

• Your contact email address

• A clear description of the concern

• Relevant order or account information

• The outcome you are seeking

• Supporting information where available

We will:

• Provide a clear method for submitting the complaint

• Acknowledge receipt within 30 days

• Take appropriate steps to investigate the complaint

• Keep you informed where appropriate

• Communicate the outcome without undue delay

We may request additional information where reasonably necessary to understand or investigate the complaint.

30. Complaints to the Information Commissioner

You have the right to complain to the Information Commissioner’s Office, the United Kingdom’s independent data-protection regulator.

We encourage you to contact us first so that we have an opportunity to review and address your concern.

Contacting us first does not restrict your right to approach the Information Commissioner’s Office directly.

31. Automated Processing and Profiling

We and our service providers may use automated systems to support:

• Fraud detection

• Payment verification

• Order-security reviews

• Account protection

• Product recommendations

• Website personalisation

• Advertising selection

• Customer segmentation

• Analytics

These systems may analyse transaction information, device information, account activity, website interactions, and other relevant information.

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects unless:

• The processing is necessary for a contract;

• It is authorised by applicable law;

• You have provided valid explicit consent where required; and

• Appropriate safeguards are provided.

You may contact us for information about relevant automated processing and available rights.

32. Children’s Privacy

The Services are intended for a general retail audience and are not designed for children to create accounts, place orders, or provide personal information independently.

Customers who have not reached the legal age to enter into a purchase contract should use the Services only with the involvement and permission of a parent or legal guardian.

We do not knowingly collect personal information directly from a child under 13 on the basis of the child’s own consent.

Where consent is relied upon for an online service offered directly to a child under 13, appropriate authorisation from a person with parental responsibility will be required.

If you believe a child has provided personal information inappropriately, contact:

Email: info@rothysy.shop

We will review the matter and take appropriate action where required.

33. Special-Category and Highly Sensitive Information

We do not ordinarily request special-category personal information, such as information concerning:

• Health

• Ethnicity

• Religion

• Political opinions

• Trade-union membership

• Biometric identification

• Sexual orientation

Please do not submit such information unless it is reasonably necessary and specifically requested for a lawful purpose.

Do not send the following by email:

• Complete payment-card numbers

• Card security codes

• Account passwords

• Online-banking credentials

• Copies of identification documents unless specifically requested through an appropriate secure process

• Other highly sensitive financial or authentication information

34. Reviews and Public Content

If you submit a review, photograph, video, comment, or other public content, that information may become visible to other visitors and the public.

Do not include:

• Payment information

• Account passwords

• Medical information

• Identification documents

• Private addresses

• Information about another person without permission

• Confidential or highly sensitive information

We may moderate or remove public content that creates privacy, security, legal, or policy concerns.

35. Social Media and Third-Party Features

The Services may contain links to or features provided by social-media platforms and other third parties.

When you interact with these features, the provider may collect information such as:

• Your Internet Protocol address

• Device information

• The page visited

• Your interaction with the feature

• Information associated with your third-party account

Your interaction with an independent platform is governed by that provider’s privacy notice and account settings.

36. Third-Party Websites

The Services may contain links to external websites, applications, payment providers, shipping services, or other resources.

We do not control and are not responsible for the privacy, security, availability, or content of independent third-party services.

Information submitted directly to a third party is governed by that party’s privacy notice and terms.

You should review applicable third-party policies before providing personal information.

37. Changes in Processing Purpose

We will generally use personal information only for the purpose for which it was collected.

We may use information for another compatible purpose where permitted by law.

If we need to process information for a materially different purpose, we will provide additional information and identify the applicable lawful basis unless a legal exception applies.

38. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

• Products and Services

• Business practices

• Shopify functionality

• Installed applications

• Technology

• Cookie and advertising practices

• Security procedures

• Service-provider arrangements

• Data-protection law

• Regulatory guidance

The revised Privacy Policy will be published on rothysy.shop with an updated effective date.

Where required, significant changes may also be communicated by email, website notice, or another appropriate method.

We encourage you to review this Privacy Policy periodically.

39. Contact Information

For privacy questions, data-protection requests, objections, withdrawals of consent, marketing preferences, or complaints, contact:

Store: rothysy.shop
Email: info@rothysy.shop

Customer and privacy enquiries are generally answered within 1–2 business days, subject to the formal legal time limits applicable to rights requests and data-protection complaints.